Insecure Direct Object Reference in Frontend File Manager Plugin for WordPress

CVE-2025-13382

What is CVE-2025-13382?

The Frontend File Manager Plugin for WordPress contains a serious vulnerability due to improper validation of file ownership. This issue affects all versions up to and including 23.4. Specifically, it arises in the '/wpfm/v1/file-rename' REST API endpoint, allowing authenticated attackers with Subscriber-level access and above to rename files uploaded by others through manipulation of the 'fileid' parameter. This oversight poses significant security risks as it enables unauthorized control over files, potentially leading to data breaches or misuse.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References